Where we work · UK and Europe
ISO and GRC consulting in UK and Europe, from ISO consultants UK and Europe firms can reach in their own time zone
Regional headquarters in London and Enschede, and an office in Germany, put a Sterling lead in your working day for ISO certification, cyber security and data protection programmes. One engagement team runs every site and country in scope; an independent, accredited certification body audits and decides.
- Regional headquarters in London and Enschede, plus an office in Germany, within easy reach of sites across the region
- Programmes shaped around UKAS, RvA and DAkkS accredited certification and the rules your buyers and regulators apply
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; an accredited body audits and decides
- An accredited certificateIssued by a body your buyers' registers recognise, such as UKAS CertCheck or the RvA register
- Tenders answeredEvidence ready for public buyers, prequalification schemes and supplier questionnaires
- Regulation mappedUK GDPR, GDPR, NIS2 and DORA duties linked to controls you already run
- One programmeEvery site and country in one scope, one Effivity workspace and one plan
Countries
Each country page sets out the regulators, the accreditation route and every standard Sterling delivers there.
- Albania0 standards and frameworks
- Andorra0 standards and frameworks
- Austria22 standards and frameworks
- Belgium22 standards and frameworks
- Bosnia and Herzegovina0 standards and frameworks
- Bulgaria0 standards and frameworks
- Croatia0 standards and frameworks
- Cyprus0 standards and frameworks
- Czechia22 standards and frameworks
- Denmark22 standards and frameworks
- Estonia0 standards and frameworks
- Finland0 standards and frameworks
- France22 standards and frameworks
- Germany23 standards and frameworks
- Greece0 standards and frameworks
- Hungary0 standards and frameworks
- Iceland0 standards and frameworks
- Ireland22 standards and frameworks
- Italy22 standards and frameworks
- Latvia0 standards and frameworks
- Liechtenstein0 standards and frameworks
- Lithuania0 standards and frameworks
- Luxembourg0 standards and frameworks
- Malta0 standards and frameworks
- Moldova0 standards and frameworks
- Monaco0 standards and frameworks
- Montenegro0 standards and frameworks
- Netherlands22 standards and frameworks
- North Macedonia0 standards and frameworks
- Norway21 standards and frameworks
- Poland22 standards and frameworks
- Portugal22 standards and frameworks
- Romania0 standards and frameworks
- San Marino0 standards and frameworks
- Serbia0 standards and frameworks
- Slovakia0 standards and frameworks
- Slovenia0 standards and frameworks
- Spain22 standards and frameworks
- Sweden22 standards and frameworks
- Switzerland21 standards and frameworks
- Ukraine0 standards and frameworks
- United Kingdom23 standards and frameworks
Offices
Sterling in UK and Europe: three offices, one engagement team.
London leads work in the United Kingdom; Enschede leads work in the Netherlands and continental Europe. Clients reach a consultant in their own time zone, and site visits need only short travel.
- London, United KingdomRegional headquarters · Kemp House, 160 City Road, London EC1V 2NX · +44 7482 876223 · uk@sterling-grc.com
- Enschede, NetherlandsRegional headquarters · De Hems 4-33, Enschede · +31 6 8383 2492 · netherlands@sterling-grc.com
- Frankfurt am Main, GermanySterling office · OpernTurm, Bockenheimer Landstrasse 2-4, Frankfurt am Main · germany@sterling-grc.com
Sterling has offices in 21 countries. Every office, with its contact details, is listed on the all offices page.
Standards in demand
The standards UK and European buyers ask for.
Quality, information security, environment and health and safety certificates are the ones most tenders and supplier questionnaires ask to see. UK public-sector suppliers add Cyber Essentials; organisations in the EU increasingly meet NIS2 and DORA duties through the security controls behind ISO/IEC 27001. Food, laboratory, payment card, AI and SOC 2 programmes follow the same method.
Bodies and regulators
Who accredits, who certifies and who regulates in UK and Europe.
Accreditation bodies accredit certification bodies; certification bodies audit and certify you; regulators and buyers decide what they expect to see. Sterling does none of the three. We prepare you for all of them.
| Country | Accreditation body and recognition | Regulators and schemes that ask for certification |
|---|---|---|
| United Kingdom | UKAS, the national accreditation body appointed by government. It accredits certification bodies and does not certify organisations; its free CertCheck database lists accredited management system certificates. UKAS is an EA MLA signatory. | The ICO, for UK GDPR security duties (Article 32), points organisations to Cyber Essentials as a starting point. PPN 014 makes Cyber Essentials, or an equivalent, essential for suppliers to central government and NHS bodies handling data. The NIS Regulations 2018 cover operators of essential services. Constructionline accepts ISO certificates only from UKAS or EA, IAF or ILAC member accredited bodies. |
| Netherlands | RvA, designated by the Dutch government in 2010 as the national accreditation body under Regulation (EC) No 765/2008. It accredits laboratories and inspection, certification and verification bodies, and keeps a public register that includes suspensions and withdrawals. | The Cyberbeveiligingswet, the Dutch NIS2 law, in force since 15 August 2026. BIO2, based on ISO/IEC 27001 and ISO/IEC 27002, for government bodies. NEN 7510 for healthcare providers, where the IGJ expects demonstrable compliance with the information security norm. The Dutch tender experts' committee advises that a buyer may require ISO 9001 if it makes clear which risks the requirement covers. |
| Germany | DAkkS, the national accreditation body of the Federal Republic of Germany. It accredits management system certification bodies to ISO/IEC 17021-1 and is a member of EA. | IFS Food, begun in 2003 by the German and French retail federations and recognised by GFSI, is one of the schemes food retailers set for suppliers. EU-wide rules in the next row apply. |
| European Union | EA, appointed under Regulation (EC) No 765/2008 to maintain the European multilateral agreement, under which members' accreditations are accepted across Europe. | GDPR Article 32 security. NIS2, Directive (EU) 2022/2555, with ENISA's technical implementation guidance of 26 June 2025 mapping requirements to ISO/IEC 27001:2022. DORA, Regulation (EU) 2022/2554, applying since 17 January 2025. Directive 2014/24/EU, Article 62: certificates from accredited bodies, with equivalents from other member states recognised. |
| Sector schemes, UK and EU | Food safety bodies work to ISO/IEC 17021-1 and ISO 22003-1. AI management system bodies add ISO/IEC 42006:2025, and UKAS and RvA now accredit bodies for ISO/IEC 42001. PCI DSS and SOC 2 are not accredited certification: a QSA and a CPA firm assess instead. | Regulation (EC) No 852/2004, Article 5, requires HACCP-based procedures after primary production, in the EU and in UK retained law. Retailers write GFSI-recognised schemes such as FSSC 22000 into supplier programmes; BRCGS Food Safety is written by and for the retail supply chain. The EU AI Act, Regulation (EU) 2024/1689, where ISO/IEC 42001 is not a harmonised standard. |
Global ACI replaced the IAF MLA and ILAC MRA on 1 January 2026. Before relying on a certificate abroad, check the certification body's accreditation on the national register and the accreditation body's status on global-aci.org.
How we deliver
One method, delivered where you are.
The same five-stage method we have refined since 2003, run from London and Enschede for clients across the region.
- One engagement team accountable across every country you operate in, with local consultants where the work is
- Remote and on site: workshops, document reviews and coaching remotely; site work where observation or in-person work is necessary, with short travel from the regional offices
- One Effivity workspace for every site, included with the engagement at no additional cost
- One certification body for multi-site programmes where the body agrees, with local requirements handled where they arise
- Design™ or Drive™: your team implements with Sterling's structure and coaching, or Sterling consultants take on the agreed consulting and documentation work
A typical engagement starts with a gap analysis against the standard and the rules that apply in each country, then implementation, internal audit and management review before the certification body's Stage 1 readiness review and Stage 2 audit. For groups with sites in the UK and continental Europe, we build one system under central control, keep a legal register per country and align UK GDPR and GDPR work so evidence is written once. Your people learn through Sterling Academy, and your records live in Effivity.
Effivity · included with the engagement
Your system runs in software from the first workshop.
Effivity is the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures it within the agreed scope, so evidence accumulates as people do their work and the certification auditor reviews a live system rather than a binder. Sterling consulting clients get their subscription included with the engagement, at no additional cost.
ISO & GRC softwareSterling Academy · included with the engagement
Your people learn the standard, not just the forms.
E-learning with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online, with progress by department for the certification audit. Sterling consulting clients get preferential course access and special pricing, including complimentary awareness training for their people as part of the engagement.
Contact us about Academy accessStandards
Most requested in UK and Europe
- ISO/IEC 27001ISO/IEC 27001 certification consulting: an ISMS built with your people, evidence prepared, and support through Stage 1, Stage 2 and surveillance audits.
- ISO 9001ISO 9001 certification consulting: a quality management system built with your people, evidence prepared and support until an accredited body certifies you.
- GDPRGDPR compliance consulting: lawful processing, data subject rights and breach response, with evidence for regulators and your customers' auditors.
- ISO 14001ISO 14001 certification consulting: aspects, impacts and compliance obligations controlled, with support until an accredited body certifies you.
- ISO 45001ISO 45001 certification consulting to prevent work-related injury and ill health, with an OH&S system built with your people and audit-ready, in 60+ countries.
- ISO 22301ISO 22301 certification consulting to keep delivering through disruption: impact analysis, continuity plans and exercises, prepared for an accredited audit.
- ISO/IEC 27701ISO/IEC 27701 certification consulting: privacy management for controllers and processors of PII, built on your ISMS and prepared for an accredited audit.
- Cyber EssentialsCyber Essentials certification consulting: the five technical controls in place for your verified self-assessment, and Cyber Essentials Plus audit-ready.
Where we work
Your business
crosses borders.
Your programme can too.
A Sterling lead in your working hours, wherever you operate. Multi-site programmes run with one engagement team, one Effivity workspace and one certification body, with local requirements and customer expectations handled where they arise.
Global headquarters in New York; regional headquarters in Dubai, Navi Mumbai, Manila, London, Enschede and Johannesburg; offices in 21 countries.
All offices and contact detailsClient experience in UK and Europe
Client letters on file, available on request.
Signed client letters for engagements in the UK and Europe are available on request. The client feedback wall lists every letter by standard. Ask for references in your sector before you decide.
- 60+countries where Sterling has delivered certification
- 21countries with a Sterling office, eight regions, one coordinated team
- 2003the year the group began implementing ISO management systems; the same method, refined, since
- 8,100+client engagements across the group, from single-site SMEs to multinationals
FAQs
Questions clients in UK and Europe ask before they engage us.
The specific answers for your organisation come from the discovery call. These are the general ones.
Do you have ISO consultants in the UK and Europe?
Yes. Sterling has regional headquarters in London and in Enschede, the Netherlands, and an office in Germany. Your engagement team works in your time zone, runs workshops and reviews remotely and visits sites where observation is needed. The same consultant stays accountable across every country in your scope, with local consultants where the work is.
Will a certificate issued in the Netherlands be accepted by UK buyers?
Usually, if the certification body is accredited and the buyer accepts the accreditation body. Constructionline, for example, accepts ISO certificates from UKAS accredited bodies or bodies accredited by EA, IAF or ILAC members. Check the buyer's wording, the certificate scope and the body's entry on the RvA or UKAS register before you choose a certification body.
Does ISO/IEC 27001 replace Cyber Essentials for UK government contracts?
No. PPN 014 makes a Cyber Essentials certificate, or equivalent, essential when data passes to a supplier of central government or NHS bodies, and it says most businesses with ISO/IEC 27001 will need Cyber Essentials as well, or must show equivalent controls. We plan both together so the controls and evidence overlap rather than repeat.
Is ISO/IEC 27001 certification required under NIS2 or the Cyberbeveiligingswet?
No law in our research requires the certificate. NIS2 and the Dutch Cyberbeveiligingswet set a duty of care, registration and incident reporting. ENISA's technical implementation guidance maps NIS2 requirements to ISO/IEC 27001:2022, so a certified management system gives you a structured way to show the measures, while supervisors judge compliance with the law itself.
Can one programme cover sites in the UK, the Netherlands and Germany?
Yes, where the certification body agrees. A multi-site programme runs as one system under central control, with one engagement team, one Effivity workspace and one certification body. Each country keeps its own legal register, and the certification body sets the audit time and site plan. We agree the audit plan and languages with the body before the Stage 1 readiness review.
Does Sterling certify organisations in the UK or Europe?
No. Sterling does not certify or accredit. Our expert and experienced consultants prepare you: gap analysis, implementation, training, internal audit and support through the audits. An independent certification body, accredited by UKAS, RvA, DAkkS or another accreditation body, audits your system and decides whether to issue the certificate.
How does UK GDPR differ from the GDPR for a group working in both?
The two remain closely related: the ICO applies UK GDPR alongside the Data Protection Act 2018, amended in stages by the Data (Use and Access) Act 2025, while EU member states apply the GDPR. A group in both markets usually keeps one privacy programme with country-specific records and notices. Our GDPR vs UK GDPR guide sets out what differs.
Keep exploring
More places we work
Talk to a consultant
Plan your certification in UK and Europe with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice